User data published after Gawker server break-in
Blog operator Gawker Media has asked the users of the Gizmodo, Gawker, Deadspin, Kotaku, Jezebel, IO9, Jalopnik and Lifehacker blogs to change their passwords. The reason for the request was that the company's servers were hacked by a group called "Gnosis", who copied and published sensitive company data, as well as users' account details, to an online torrent web site.
While the 1.3 million compromised passwords are said to be DES encrypted, this type of encryption no longer presents a major obstacle to password crackers, especially if the passwords are weak. Gnosis said that they managed to obtain the password of Gawker founder Nick Denton, who apparently also uses the same password on Google and Twitter.
Denton reportedly even continued to use the same password on other servers after becoming aware that it had been compromised. The hackers said that they used Denton's account details to access other information, such as the source code of Gawker projects and internal communication protocols. The intruders apparently wanted to take revenge because Denton had classified their group, which is affiliated with 4chan and Anonymous, as "script kiddies". Over the past few days, Anonymous organised "Operation Payback" to attack various services including Amazon, PayPal and MasterCard, who had blocked WikiLeaks transactions and accounts.
An FAQ page on the Lifehacker blog provides more details about the compromised commenting accounts.